EU cyber agency: vulnerabilities up by 300 per cent with AI - Il Sole 24 ORE
Cyber vulnerabilities in the EU have increased by over 300% in the last three months compared to the same period last year, with AI accelerating the discovery of flaws in digital systems, according to ENISA.
The time available for businesses to defend against cyberattacks is diminishing to almost zero as artificial intelligence has accelerated the discovery of vulnerabilities in digital systems, according to the latest EU cybersecurity report.
The 2026 report by ENISA, the European Union Agency for Cybersecurity, reveals that vulnerabilities detected over the past three months have surged by over 300% compared to the same period last year. Previously, these flaws were identified mainly by researchers or specialist firms.
Now, thanks to artificial intelligence, vulnerabilities can be identified on an industrial scale.
Geopolitical tensions fuel cyber threats
The report paints a picture of a 27-member Europe better equipped than two years ago but facing new challenges. The level of cyber threat remains 'substantial,' with conflicts in Ukraine and the Middle East accelerating hostile cyber activities against the Union, fueling what's known as 'hybrid war.'
In 2025, 57.3% of analyzed incidents were ideologically motivated, 29.3% for financial gain, and 5.9% for cyberespionage. The public sector remains the hardest-hit, accounting for 31.8% of incidents, followed by business services (8.5%), transport (8%), and manufacturing (6.9%).
Financial attacks pose greatest risks
While ideologically motivated DDoS attacks dominate in the public sector (81.8% of incidents), attacks for financial gain have the most serious consequences for business continuity, particularly ransomware. In 2022, ENISA estimated the median direct cost of major cyber incidents at 300,000 euros.
Fifty-five percent of organizations surveyed by ENISA cite ransomware as a primary threat, while 47% mention attacks on supply chains. Excluding banking, over a third of organizations feel unprepared to handle cyber risks related to supply chains. In IT service management, 45% take more than three months to install critical security updates on equally critical systems.
These are companies that provide services to other businesses, which therefore remain vulnerable throughout this period.
EU response and future challenges
A breach in a single supplier's systems can spread throughout entire supply chains with cross-border consequences. The Cyber Resilience Act, which will be fully applicable from December 2027, aims to reduce exposure by introducing security obligations from the design stage of digital products.
Brussels is tackling the threat through regulation and investment, allocating 1.4 billion euros between 2021 and 2027 via Horizon Europe and Digital Europe programs. The European Cybersecurity Index gives the EU an average score of 71.53 out of 100, with 22 Member States showing high maturity and two at an advanced level.
However, a common response to the threat still seems distant. "There is a solid framework for crisis management. What is still lacking is a shared, real-time picture of the situation," says Lepassaar.
Related
